github-builder: reject duplicate Bake secret IDs

__tests__/github-builder/build-secrets.test.ts

@@ -88,10 +88,16 @@ describe('BuildSecrets', () => {
     expect(mkdir).not.toHaveBeenCalled();
   });
 
-  it('preserves override order for duplicate canonical Bake IDs', () => {
-    const result = BuildSecrets.prepareBake('token: first\napp:\n  token: second', 'app', ['app']);
+  it.each(['token: first\napp:\n  token: second', 'app:\n  token: first\ntoken: second'])('rejects duplicate canonical Bake IDs before writing files for %j', input => {
+    const mkdir = vi.spyOn(fs, 'mkdtempSync');
+    expect(() => BuildSecrets.prepareBake(input, 'app', ['app'])).toThrow('Duplicate build secret ID "token" for Bake target "app"');
+    expect(mkdir).not.toHaveBeenCalled();
+  });
+
+  it('allows the same Bake secret ID on different targets', () => {
+    const result = BuildSecrets.prepareBake('token: first\nrelease:\n  token: second', 'app', ['app', 'release']);
     directories.push(result.directory);
-    expect(result.inputs).toEqual([0, 1].map(index => `app.secret.token=src=${path.join(result.directory, String(index))}`));
+    expect(result.inputs).toEqual([`app.secret.token=src=${path.join(result.directory, '0')}`, `release.secret.token=src=${path.join(result.directory, '1')}`]);
   });
 
   it('uses private files, unique directories and idempotent cleanup', () => {

src/github-builder/build-secrets.ts

@@ -55,6 +55,7 @@ export class BuildSecrets {
 
   public static prepareBake(input: string, defaultTarget: string, targets: Array<string>): PreparedBuildSecrets {
     const allowedTargets = new Set(targets);
+    const seen = new Set<string>();
     const secrets = Object.entries(BuildSecrets.parse(input)).flatMap(([key, value]) => {
       if (typeof value !== 'string' && (!value || typeof value !== 'object' || Array.isArray(value))) {
         throw new Error('build-secrets entries must be secret strings or target mappings');
@@ -75,7 +76,12 @@ export class BuildSecrets {
         if (typeof secret !== 'string') {
           throw new Error('build-secrets values within target mappings must be strings');
         }
-        return {key: `${target}.secret.${id}`, value: secret};
+        const overrideKey = `${target}.secret.${id}`;
+        if (seen.has(overrideKey)) {
+          throw new Error(`Duplicate build secret ID "${id}" for Bake target "${target}"`);
+        }
+        seen.add(overrideKey);
+        return {key: overrideKey, value: secret};
       });
     });
     return BuildSecrets.write(secrets, 'src=');